Peter M. Groen / oletools

Commit 450782767774a1db8700d89f8707b33f57072f21

Authored by decalage2
1 parent 2f9505d9

olevba: fixed issue #148 for option --reveal

Inline Side-by-side
Showing 1 changed file with 6 additions and 3 deletions
oletools/olevba.py
  View file @4507827
... ... @@ -191,8 +191,9 @@ from __future__ import print_function
191 191 # 2017-02-07 PL: - temporary fix for issue #132
192 192 # - added keywords for Mac-specific macros (issue #130)
193 193 # 2017-03-08 PL: - fixed absolute imports
  194 +# 2017-03-16 PL: - fixed issue #148 for option --reveal
194 195  
195   -__version__ = '0.51dev2'
  196 +__version__ = '0.51dev3'
196 197  
197 198 #------------------------------------------------------------------------------
198 199 # TODO:
... ... @@ -1902,7 +1903,8 @@ def detect_dridex_strings(vba_code):
1902 1903 :param vba_code: str, VBA source code
1903 1904 :return: list of str tuples (encoded string, decoded string)
1904 1905 """
1905   - from .thirdparty.DridexUrlDecoder.DridexUrlDecoder import DridexUrlDecode
  1906 + # TODO: move this at the beginning of script
  1907 + from oletools.thirdparty.DridexUrlDecoder.DridexUrlDecoder import DridexUrlDecode
1906 1908  
1907 1909 results = []
1908 1910 found = set()
... ... @@ -2837,7 +2839,8 @@ class VBA_Parser(object):
2837 2839 # based on the length of the encoded string, in reverse order:
2838 2840 analysis = sorted(analysis, key=lambda type_decoded_encoded: len(type_decoded_encoded[2]), reverse=True)
2839 2841 # normally now self.vba_code_all_modules contains source code from all modules
2840   - deobf_code = self.vba_code_all_modules
  2842 + # Need to collapse long lines:
  2843 + deobf_code = vba_collapse_long_lines(self.vba_code_all_modules)
2841 2844 for kw_type, decoded, encoded in analysis:
2842 2845 if kw_type == 'VBA string':
2843 2846 #print '%3d occurences: %r => %r' % (deobf_code.count(encoded), encoded, decoded)
... ...